能力值:
( LV2,RANK:10 )
|
-
-
4 楼
可能我问的不是很清楚: 我意思是 .text.createODexFile:000003F4 EXPORT createODexFile .text.createODexFile:000003F4 createODexFile .text.createODexFile:000003F4 PUSH {R4-R6,LR} .text.createODexFile:000003F6 MOV R4, R0 .text.createODexFile:000003F8 BL _Z13createDexFileP7_JNIEnvPKcS2_ ; createDexFile(_JNIEnv *,char const*,char const*) .text.createODexFile:000003FC LDR R3, [R4] .text.createODexFile:000003FE LDR R1, =(.LC0-0x406) ; "dalvik/system/DexFile" .text.createODexFile:00000400 LDR R2, [R3,#0x18] .text.createODexFile:00000402 ADD R1, PC ; "dalvik/system/DexFile" .text.createODexFile:00000404 MOV R5, R0 .text.createODexFile:00000406 MOV R0, R4 .text.createODexFile:00000408 BLX R2 .text.createODexFile:0000040A LDR R6, [R4] .text.createODexFile:0000040C LDR R2, =(.LC0-0x2D0) ; "dalvik/system/DexFile" .text.createODexFile:0000040E LDR R3, =(.LC0-0x2CE) ; "dalvik/system/DexFile" .text.createODexFile:00000410 ADD R2, PC ; "close" .text.createODexFile:00000412 LDR.W R6, [R6,#0x84] .text.createODexFile:00000416 ADD R3, PC ; "()V" .text.createODexFile:00000418 MOV R1, R0 .text.createODexFile:0000041A MOV R0, R4 .text.createODexFile:0000041C BLX R6 .text.createODexFile:0000041E CBZ R5, loc_438 .text.createODexFile:00000420 MOV R2, R0 .text.createODexFile:00000422 MOV R1, R5 .text.createODexFile:00000424 MOV R0, R4 .text.createODexFile:00000426 BL _ZN7_JNIEnv14CallVoidMethodEP8_jobjectP10_jmethodIDz ; _JNIEnv::CallVoidMethod(_jobject *,_jmethodID *,...) .text.createODexFile:0000042A LDR R3, [R4] .text.createODexFile:0000042C MOV R0, R4 .text.createODexFile:0000042E MOV R1, R5 .text.createODexFile:00000430 LDR R4, [R3,#0x5C] .text.createODexFile:00000432 BLX R4 .text.createODexFile:00000434 MOVS R0, #1 .text.createODexFile:00000436 POP {R4-R6,PC} .text.createODexFile:00000438 ; --------------------------------------------------------------------------- .text.createODexFile:00000438 .text.createODexFile:00000438 loc_438 ; CODE XREF: createODexFile+2Aj .text.createODexFile:00000438 MOV R0, R5 .text.createODexFile:0000043A POP {R4-R6,PC} .text.createODexFile:0000043A ; End of function createODexFile .text.createODexFile:0000043A
如果 r2=0x7F0-0x3BE = 0x432 ,那么对应是: .text.createODexFile:00000432 BLX R4 这条语句,那R2 里面是这个地址值
; createClassLoader(_JNIEnv *, _jclass *, _jobject *, _jobject *) .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004AC EXPORT _Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_ .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004AC _Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_ .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004AC ; CODE XREF: loadDex(_JNIEnv *,_jobject *,_jstring *,_jstring *)+50p .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004AC ; attach+64p .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004AC .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004AC var_20 = -0x20 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004AC .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004AC PUSH.W {R4-R8,LR} .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004B0 MOV R7, R2 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004B2 LDR R5, [R0] .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004B4 MOV R6, R3 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004B6 LDR R2, =(.LC0-0x3BE) ; "dalvik/system/DexFile" .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004B8 SUB SP, SP, #8 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004BA LDR R3, =(.LC0-0x29C) ; "dalvik/system/DexFile" .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004BC MOV R4, R0 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004BE ADD R2, PC ; "<init>" .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004C0 LDR.W R5, [R5,#0x84] .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004C4 ADD R3, PC ; "(Ldalvik/system/DexFile;Ljava/lang/Clas"... .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004C6 MOV R8, R1 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004C8 BLX R5 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004CA STR R6, [SP,#0x20+var_20] .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004CC MOV R1, R8 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004CE MOV R3, R7 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004D0 MOV R2, R0 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004D2 MOV R0, R4 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004D4 BL _ZN7_JNIEnv9NewObjectEP7_jclassP10_jmethodIDz ; _JNIEnv::NewObject(_jclass *,_jmethodID *,...) .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004D8 ADD SP, SP, #8 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004DA POP.W {R4-R8,PC} .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004DA ; End of function createClassLoader(_JNIEnv *,_jclass *,_jobject *,_jobject *)
这个函数中的 .text._Z17createClassLoaderP7_JNIEnvP7_jclassP8_jobjectS4_:000004B6 LDR R2, =(.LC0-0x3BE) ; "dalvik/system/DexFile" 来看是没有什么用的代码,那怎么回这样?
|